AWS privateca medium security documentation change

Service: privateca · 2025-12-07 · Security-related medium

File: privateca/latest/userguide/pca-rbp.md

Summary

Updated IAM policy examples to reference certificate authority ARNs instead of individual certificate ARNs

Security assessment

Correcting IAM resource ARNs ensures proper scoping of permissions for AWS Private CA. The prior example could have led to overly broad permissions if misused, which is a security concern.

Diff

diff --git a/privateca/latest/userguide/pca-rbp.md b/privateca/latest/userguide/pca-rbp.md
index 62e570081..0d6b1e76a 100644
--- a//privateca/latest/userguide/pca-rbp.md
+++ b//privateca/latest/userguide/pca-rbp.md
@@ -133 +133 @@ JSON
-                "Resource":"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/CA_ID/certificate/certificate_ID",
+                "Resource":"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/CA_ID",
@@ -155 +155 @@ JSON
-                "Resource":"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/CA_ID/certificate/certificate_ID",
+                "Resource":"arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/CA_ID",